CVE-2021-36899

The CVE-2021-36899 entry concerns the WordPress Asset CleanUp: Page Speed Booster plugin, versions

CVE-2022-38460

CVE-2022-38460 : Authenticated (contributor+) Stored Cross-Site Scripting in the WordPress plugin NOTICE BOARD (versions ≤ 1.1). The vulnerability arises from inadequate data filtering/escaping of user input, enabling XSS when a user with contributor+ privileges interacts with the plugin. Several...

CVE-2022-36365

Multiple Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerabilities in WHA Crossword plugin = 1.1.10 at WordPress...

PT-2022-22952 · Hans Matzen · Wp-Forecast

Name of the Vulnerable Software and Affected Versions: Hans Matzen's wp-forecast plugin versions = 7.5 Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into the...

CVE-2022-36405

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in amCharts: Charts and Maps plugin = 1.4 at WordPress...

PT-2022-21929 · WordPress · Bxslider Wp

Name of the Vulnerable Software and Affected Versions: BxSlider WP plugin versions = 2.0.0 Description: The issue is an Authenticated Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher roles. There is no information provided about the estimated number of potential...

CVE-2022-29923

CVE-2022-29923 is an authenticated reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin ThingsForRestaurants Quick Restaurant Reservations . The issue affects the plugin versions up to and including 1.4.1 and requires an administrator or higher user role to exploit (attack v...

CVE-2022-31029 Authenticated XSS in Pi-hole AdminLTE

AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like alert"XSS" in the field marked with "Domain to look for" and hitting enter or clicking on any of the buttons will execute the script. The user must be logged in to use this vulnerability. Usually...

CVE-2022-30536

Authenticated Stored Cross-Site Scripting XSS vulnerability in Florent Maillefaud's WP Maintenance plugin = 6.0.7 at WordPress...

CVE-2022-29433

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-25612

CVE-2022-25612 affects WordPress WordPress Simple Event Planner plugin ≤ 1.5.4. The vulnerability is a stored/authenticated Cross-Site Scripting (XSS) resulting from insufficient sanitization of Event Options (e.g., event_organiser, organiser_email, organiser_contact) when a user with author or h...

CVE-2022-22791

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

CVE-2021-36919

Multiple Authenticated Reflected Cross-Site Scripting XSS vulnerabilities in WordPress Awesome Support plugin versions = 6.0.6, vulnerable parameters &id, &assignee...

CVE-2021-36919

CVE-2021-36919 affects WordPress Awesome Support plugin

CVE-2021-36843 WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Floating Social Media Icon plugin versions = 4.3.5 Social Media Configuration form. Requires high role user like admin...

CVE-2021-36841

Authenticated Stored Cross-Site Scripting XSS vulnerability in YITH Maintenance Mode WordPress plugin versions = 1.3.7, vulnerable parameter &yithmaintenancenewslettersubmitlabel. Possible even when unfiltered HTML is disallowed by WordPress configuration...

CVE-2021-36875

Summary of CVE-2021-36875 : Affected software is the WordPress uListing plugin (versions

CVE-2021-36870

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in WordPress WP Google Maps plugin versions = 8.1.12. Vulnerable parameters: name, gdprretentionpurpose, gdprcompanyname, 2, , 2, ,...

CVE-2021-3628

OpenKM Community Edition 6.3.10 is vulnerable to authenticated Cross-site Scripting (XSS) via the uuid parameter. The issue arises from unvalidated input in the uuid field, allowing an attacker to inject arbitrary client-side code after authentication. Documented across multiple sources (NVD entr...

CVE-2021-24512

The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting XSS vulnerability in one of the administrative functions for handling deletion of videos...